Open-AudIT Professional 3.3.1 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Exploit Author: Askar CVE: CVE-2020-8813 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11943

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

CVE-2020-11943

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

Design/Logic Flaw

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

Sql injection

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11943

An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload...

CVE-2020-11943

Open-AudIT 3.2.2 contains an arbitrary file upload vulnerability in the Add Image workflow. An authenticated attacker can upload a PHP file (simple-backdoor.php) via the image upload endpoint and access it to execute commands, as demonstrated by a PoC that places the backdoor under custom_images ...

CVE-2020-11942

An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections...

CVE-2020-11942

Open-AudIT 3.2.2 contains SQL injection in device scripts via unsanitized parameters system.class and system.discovery_id, enabling an attacker to modify or execute arbitrary SQL statements (e.g., via crafted requests to /devices). PoC shows TRUE/FALSE payloads returning different response sizes,...

Microsoft Office 365 Security Recommendations

Summary As organizations adapt or change their enterprise collaboration capabilities to meet “telework” requirements, many organizations are migrating to Microsoft Office 365 O365 and other cloud collaboration services. Due to the speed of these deployments, organizations may not be fully...

Open-AudIT Professional 3.3.1 Remote Code Execution

Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-12078 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...

Opmantek Open-AudIT Cross-Site Scripting Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Opmantek Open-AudIT version 3.3.0. The vulnerability stems from...

Opmantek Open-AudIT Injection Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. Opmantek Open-AudIT suffers from an injection vulnerability. An attacker can exploit this vulnerability to inje...

Open-AudIT Professional 3.3.1 - Remote Code Execution

Exploit Title: Open-AudIT Professional 3.3.1 - Remote Code Execution Date: 2020-04-22 Exploit Author: Askar CVE: CVE-2020-8813 Vendor Homepage: https://opmantek.com/ Version: v3.3.1 Tested on: Ubuntu 18.04 / PHP 7.2.24 !/usr/bin/python3 import requests import sys import warnings import random...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 allows an XSS attack after login...

Design/Logic Flaw

Open-AudIT 3.3.0 allows an XSS attack after login...

CVE-2020-12261

Open-AudIT 3.3.0 is affected by a reflected/authenticated cross-site scripting vulnerability (CVE-2020-12261). The issue arises in the web interface after login, where crafted input (e.g., payloads placed in the search path) can execute client-side scripts. Public references include Exploit-DB an...